SNAFUE is effective for attacks between similar classes. There are many natural visual features that image classifiers may encounter and many more possible combinations thereof, so it is important that tools for interpretability and diagnostics with natural features are scalable.
Here, we test the scalability of SNAFUE and test its effectiveness with a broad search for vulnerabilities.
Based on prior proofs of concept [1]}, [2]}, [3]}, [4]} copy/paste attacks tend to be much easier to create when the source and target class are related.
To choose similar source/target pairs, we computed the confusion matrix \(C\)  for the target network with \(0 \le C_{ij} \le 1\)  giving the mean post-softmax confidence on class \(j\)  that the network assigned to validation images of label \(i\) .
Then for each of the 1,000 ImageNet classes, we conducted 5 attacks using that class as the source and each of its most confused 5 classes as targets.
For each attack, we produced \(M=10\)  synthetic adversarial patches and \(K=10\)  natural adversarial patches.
